I think there has been 3 times an intrusion in my computer.
Last week, I was listening music on my computer (ubuntu 12.04.1 LTS on a MacBook Air 4,2), my hands were far from keyboard and trackpad (on a real book) and Firefox had the focus. I'm not a geek and not a 'mum-and-dad' user.
I saw the web page I had opened self-scrolling a few (not reloading). I move the moose and 5 min later it happened again. I disable wifi. At that time aMule was running. Skype too. Some ports were open but not for my IP address. My system was updated 3 hours ago (but not the kernel) and so up-to-date.
10 min later, the ubuntu update manager prompt me updates for the linux kernel. One package was named using Russian (linux-image-generic). It never happened before, so I didn't applied it yet. Yes, I've added Russian language to keyboard-maps and Russian virtual/visual keyboard.
3 days later I saw again an open web page self-scrolling in Firefox. aMule wasn't running, but skype was.
One day later (now), I even find some packages' names translated in Russian in Ubuntu Software Center. Not apps, only packages.
1. How can I know if there has been an intrusion in my computer ?
2. How can I know if someone remotely changed/corrupted some packages or configuration in my system ?
3. Especially something concerning the update manager ? And Firefox profile ?
Latter, using (for the first time)
sudo lsof -i | grep ESTABLISHED
I didn't notice any strange connection (but I may be wrong).
And (the first time too)
Checking `sniffer'... wlan0: PACKET SNIFFER(/sbin/wpa_supplicant, /sbin/dhclient)
Please don't answer me make a new Firefox profile or install a new system (I can take that decision and do it ;-) ) : I want to know, understand, fix and being protected next time.
Here is : the output of
sudo lsof -i -n -P
sudo lsof -i -n -P. To answer the "how can I know" question, well, you can't, unless you have a backup to compare to.